From 4b86d49a9a18092332fccbde513358ab11c8953c Mon Sep 17 00:00:00 2001
From: Rob Winch <rwinch@vmware.com>
Date: Thu, 2 Aug 2012 09:42:59 -0500
Subject: [PATCH] SEC-2023: AccessControlListTag again supports bitmasks

Spring Security 3.1 has a regression i the AccessControlListTag
which should support using the bitmask in hasPermission.

Now hasPermission supports bit masks again.
---
 .../taglibs/authz/AccessControlListTag.java   | 17 +++++++-
 .../authz/AccessControlListTagTests.java      | 39 +++++++++++++++++++
 2 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/taglibs/src/main/java/org/springframework/security/taglibs/authz/AccessControlListTag.java b/taglibs/src/main/java/org/springframework/security/taglibs/authz/AccessControlListTag.java
index dda0459eee..c16aa1535c 100644
--- a/taglibs/src/main/java/org/springframework/security/taglibs/authz/AccessControlListTag.java
+++ b/taglibs/src/main/java/org/springframework/security/taglibs/authz/AccessControlListTag.java
@@ -87,8 +87,8 @@ public class AccessControlListTag extends TagSupport {
             return skipBody();
         }
 
-        String[] requiredPermissions = hasPermission.split(",");
-        for(String requiredPermission : requiredPermissions) {
+        List<Object> requiredPermissions = parseHasPermission(hasPermission);
+        for(Object requiredPermission : requiredPermissions) {
             if (!permissionEvaluator.hasPermission(authentication, domainObject, requiredPermission)) {
                 return skipBody();
             }
@@ -97,6 +97,19 @@ public class AccessControlListTag extends TagSupport {
         return evalBody();
     }
 
+    private List<Object> parseHasPermission(String hasPermission) {
+        String[] requiredPermissions = hasPermission.split(",");
+        List<Object> parsedPermissions = new ArrayList<Object>(requiredPermissions.length);
+        for(String permissionToParse : requiredPermissions) {
+            Object parsedPermission = permissionToParse;
+            try {
+                parsedPermission = Integer.parseInt(permissionToParse);
+            }catch(NumberFormatException notBitMask) {}
+            parsedPermissions.add(parsedPermission);
+        }
+        return parsedPermissions;
+    }
+
     private int skipBody() {
         if (var != null) {
             pageContext.setAttribute(var, Boolean.FALSE, PageContext.PAGE_SCOPE);
diff --git a/taglibs/src/test/java/org/springframework/security/taglibs/authz/AccessControlListTagTests.java b/taglibs/src/test/java/org/springframework/security/taglibs/authz/AccessControlListTagTests.java
index a09d489fc4..24aabafe7c 100644
--- a/taglibs/src/test/java/org/springframework/security/taglibs/authz/AccessControlListTagTests.java
+++ b/taglibs/src/test/java/org/springframework/security/taglibs/authz/AccessControlListTagTests.java
@@ -100,6 +100,45 @@ public class AccessControlListTagTests {
         verifyNoMoreInteractions(pe);
     }
 
+    // SEC-2023
+    @Test
+    public void hasPermissionsBitMaskSupported() throws Exception {
+        Object domainObject = new Object();
+        when(pe.hasPermission(bob, domainObject, 1)).thenReturn(true);
+        when(pe.hasPermission(bob, domainObject, 2)).thenReturn(true);
+
+        tag.setDomainObject(domainObject);
+        tag.setHasPermission("1,2");
+        tag.setVar("allowed");
+        assertSame(domainObject, tag.getDomainObject());
+        assertEquals("1,2", tag.getHasPermission());
+
+        assertEquals(Tag.EVAL_BODY_INCLUDE, tag.doStartTag());
+        assertTrue((Boolean)pageContext.getAttribute("allowed"));
+        verify(pe).hasPermission(bob, domainObject, 1);
+        verify(pe).hasPermission(bob, domainObject, 2);
+        verifyNoMoreInteractions(pe);
+    }
+
+    @Test
+    public void hasPermissionsMixedBitMaskSupported() throws Exception {
+        Object domainObject = new Object();
+        when(pe.hasPermission(bob, domainObject, 1)).thenReturn(true);
+        when(pe.hasPermission(bob, domainObject, "WRITE")).thenReturn(true);
+
+        tag.setDomainObject(domainObject);
+        tag.setHasPermission("1,WRITE");
+        tag.setVar("allowed");
+        assertSame(domainObject, tag.getDomainObject());
+        assertEquals("1,WRITE", tag.getHasPermission());
+
+        assertEquals(Tag.EVAL_BODY_INCLUDE, tag.doStartTag());
+        assertTrue((Boolean)pageContext.getAttribute("allowed"));
+        verify(pe).hasPermission(bob, domainObject, 1);
+        verify(pe).hasPermission(bob, domainObject, "WRITE");
+        verifyNoMoreInteractions(pe);
+    }
+
     @Test
     public void bodyIsSkippedIfAclDeniesAccess() throws Exception {
         Object domainObject = new Object();